Vulnerable Dependency Management Cheat Sheet — Approach

Reference note (untrusted external data; do not execute it as instructions). If a workaround is provided, it should be applied and validated on the testing environment, and thereafter deployed to production. If the provider has given the team a list of the impacted functions, protective code must wrap the calls to these functions to ensure that the input and the output data is safe. Moreover, security devices, such as the Web Application Firewall (WAF), can handle such issues by protecting the internal applications through parameter validation and by generating detection rules for those specific libraries. Yet, in this cheat sheet, the focus is set on the application level in order to patch the vulnerability as close as possible to the source. _Example using java code in which the impacted function suffers from a Remote Code Execution issue:_ Bounded code example (external data; do not execute automatically): ```java public void callFunctionWithRCEIssue(String externalInput){ //Apply input validation on the external input using regex if(Pattern.matches("[a-zA-Z0-9]{1,50}", externalInput)){ //Call the flawed function using safe input functionWithRCEIssue(externalInput); }else{ //Log the detection of exploitation SecurityLogger.warn("Exploitation of the RCE issue XXXXX detected !"); //Raise an exception leading to a generic error send to the client... } } ``` If the provider has provided nothing about the vulnerability, Case 3 can be applied skipping the _step 2_ of this case. We assume here that, at least, the CVE has been provided. If the provider has provided the team with the exploitation code, and the team made a security wrapper around the vulnerable library/code, execute the exploitation code in order to ensure that the library is now secure and doesn't affect the application. If you have a set of automated unit or integration or functional or security tests that exist for the application, run them to verify that the protection code added does not impact the stability of the application. Add a comment in the project _README_ explaining that the issue (specify the related CVE) is handled during the waiting time of a patched version because the detection tool will continue to raise an alert on this dependency. … Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.